Unauthorized Wire Transfers to China

Watch For Scams is dedicated to helping you avoid becoming a victim of fraud.

If you like this ezine, do a friend a big favor and forward this to them. If a friend forwarded this to you, and if you like what you read, please subscribe by visiting the link below:

Subscribe Here

Unauthorized Wire Transfers to China

In a typical scenario, the computer of a person within a company who can initiate funds transfers on behalf of the U.S. business is compromised by either a phishing e-mail or by visiting a malicious Web site.

The malware harvests the user’s corporate online banking details. When the authorized user attempts to log in to the user’s bank Web site, the user is typically redirected to another Web page stating the bank Web site is under maintenance or is unable to access the accounts.

While the user is experiencing logon issues, scammers initiate the unauthorized transfers to commercial accounts held at intermediary banks typically located in New York.

Account funds are then transferred to the Chinese economic and trade company bank account. Victims tend to be small-to-medium sized businesses and public institutions that have accounts at local community banks and credit unions, some of which use third-party service providers for online banking services.

The intended recipients of the international wire transfers are economic and trade companies located in the Heilongjiang province in the People’s Republic of China. The companies are registered in port cities that are located near the Russia-China border.

The FBI has identified multiple companies that were used for more than one unauthorized wire transfer. However, in these cases the transfers were a few days apart and never used again.

Generally, the scammers use different companies to receive the transfers. The companies used for this fraud include the name of a Chinese port city in their official name. These cities include: Raohe, Fuyuan, Jixi City, Xunke, Tongjiang, and Dongning. The official name of the companies also include the words “economic and trade,” “trade,” and “LTD.”

The economic and trade companies appear to be registered as legitimate businesses and typically hold bank accounts with the Agricultural Bank of China, the Industrial and Commercial Bank of China, and the Bank of China.

Money transfers to companies that contain these described characteristics should be closely scrutinized.

The unauthorized wire transfers range from $50,000 to $985,000. In most cases, they tend to be above $900,000, but the scammers have been more successful in receiving the funds when the unauthorized wire transfers were under $500,000. When the transfers went through successfully, the money was immediately withdrawn from or transferred out of the recipients’ accounts.

In addition to the large wire transfers, the scammers also sent domestic ACH and wire transfers to money mules in the United States within minutes of conducting the overseas transfers. The domestic wire transfers range from $200 to $200,000.

The intended recipients are money mules, individuals who the victim company has done business with in the past, and in one instance, a utility company located in another U.S. state. The additional ACH transfers initiated using compromised accounts range from $222,500 to $1,275,000.

For recommendations on how businesses can Protect, Detect, and Respond to Corporate Account Takeovers such as this, refer to the “Fraud Advisory for Businesses: Corporate Account Take Over” available at http://www.fsisac.com/files/public/db/p265.pdf.

If you have been a victim of this type of scam or any other Cyber crime, you can report it to the IC3 website at: www.IC3.gov. The IC3 complaint database links complaints for potential referral to the appropriate law enforcement agency for case consideration. Complaint information is also used to identity emerging trends and patterns.

Remember - always watch for scams!

Steve